Microsoft announces complete ban of simple or commonly used passwords from all of its accounts
Microsoft account holders are being forced to upgrade their passwords, after the company announced a ban for all simple or commonly used login credentials.
The move comes after a hacker placed 117 million LinkedIn account details including names, emails and passwords up for sale, forcing the professional business social network to invalidate affected passwords.
Password Complexity
Poor passwords have long been the bane of security professionals, and now the Microsoft Identity Division has forced users to use more complex passwords to better protect their Microsoft accounts.
The company said that has already activated this feature for regular Microsoft Account users and is holding a limited private preview for Microsoft Azure Active Directory services.
It has banned the use of easy-to-guess passwords (such as password or 12345678) on Hotmail, ever since 2011.
“The most important thing to keep in mind when selecting a password is to choose one that is unique, and therefore hard to guess,” said Alex Weinert, Group Program Manager of Azure AD Identity Protection team. “We help you do this in the Microsoft Account and Azure AD system by dynamically banning commonly used passwords.”
He pointed that Microsoft is seeing more than 10 million accounts attacked daily.
“So we have a lot of data about which passwords are in play in those attacks,” he wrote. “We use this data to maintain a dynamically updated banned password list.”
Long Campaign
Microsoft has been trying hard to improve user authentication for a while now. Last year it announced certain Windows 10 apps and services would be password free, and would use biometric security instead.
But it is not the only organisation trying to persuade users to utilise more complex passwords. Last year GCHQ, the UK’s top secret surveillance intelligence agency, offered up its advice on how consumers can ensure their passwords are fit for purpose.
And this is because users are pretty bad when it comes to using easy passwords. Research from security firm SplashData for example has shown that the world’s most common passwords are ‘123456’, closely followed by ‘password’. These two passwords have topped the list of bad passwords since the survey began in 2011.
Last June research from security firm Trustwave found that over half of passwords tested could be cracked in less than 24 hours. The firm examined 499,556 hashed passwords gathered during thousands of penetration tests performed throughout last year, found that 51 percent of those could be cracked within 24 hours and 88 percent within two weeks.
Weak passwords are a major factor in many of security breaches, as hackers take advantage of poor controls to hack into company networks.
Even password storing tools may not be a safe alternative, after the password storing site Lastpass was hacked last year.
Comments